package classify

import "time"

// TrafficClass represents a classified network traffic category.
type TrafficClass string

const (
	ClassICMP     TrafficClass = "ICMP"
	ClassDNS      TrafficClass = "DNS"
	ClassHTTPS    TrafficClass = "HTTPS"
	ClassHTTP     TrafficClass = "HTTP"
	ClassSSH      TrafficClass = "SSH"
	ClassSMTP     TrafficClass = "SMTP"
	ClassNTP      TrafficClass = "NTP"
	ClassDHCP     TrafficClass = "DHCP"
	ClassOtherTCP TrafficClass = "other-TCP"
	ClassOtherUDP TrafficClass = "other-UDP"
	// D-04: ClassUnknown replaced by 4 hash-bucketed classes for distinct tones
	ClassUnknown1 TrafficClass = "unknown-1"
	ClassUnknown2 TrafficClass = "unknown-2"
	ClassUnknown3 TrafficClass = "unknown-3"
	ClassUnknown4 TrafficClass = "unknown-4"
)

// AllClasses returns all known traffic classes in display order.
func AllClasses() []TrafficClass {
	return []TrafficClass{
		ClassICMP, ClassDNS, ClassHTTPS, ClassHTTP, ClassSSH,
		ClassSMTP, ClassNTP, ClassDHCP, ClassOtherTCP, ClassOtherUDP,
		ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
	}
}

// ClassifiedPacket pairs a raw packet's classification result with metadata.
type ClassifiedPacket struct {
	Class     TrafficClass
	SrcPort   uint16
	DstPort   uint16
	Protocol  string    // "tcp", "udp", "icmp"
	Length    int
	Timestamp time.Time // Set from pkt.Metadata().CaptureInfo.Timestamp; zero in live mode (D-01)
}

// WindowSnapshot holds aggregated packet counts for a time window.
// This is the contract between the aggregation stage and future audio synthesis (Phase 2).
type WindowSnapshot struct {
	Counts       map[TrafficClass]int64
	TotalPackets int64
	WindowIndex  int
}